[albert20260301]

Summary

• sync the semantic pull-request workflow to the shared policy
• pin the runner to Ubuntu 24.04 and the semantic-title action to its reviewed commit
• apply least-privilege permissions, bounded runtime, and per-PR concurrency

Validation

• git diff --check
• exact byte comparison with the canonical semantic-workflow template
• bash scripts/validate-workflow-policy.sh . still reports the existing ci.yml runner policy drift; that unrelated workflow is intentionally out of scope for this focused PR

Impact

This changes only pull-request title validation infrastructure. It does not change the SDK API or release artifacts.

[albert20260301]

@leonkenneth could you review this?

I picked you because the Ruby stack is the closest ownership signal available for this repository. CI is pending. The main review focus is whether the workflow preserves pull-request title validation while applying the shared runner, action-pin, permission, timeout, and concurrency policy.